Systems and methods for dynamic flexible authentication in a cloud service
Systems and methods for authenticating a user requesting access to a resource in a cloud-computing system. The methods comprise, by a resource service: receiving an access request for accessing a resource associated with the resource service from a computing device associated with a user, determining context information corresponding to the access request, and using the determined context information for identifying an authentication protocol for authenticating the user. The authentication protocol includes at least one authentication scheme. The methods further comprise generating an authentication challenge and transmitting the authentication challenge to the computing device. The authentication challenge includes an initial token and authentication parameters corresponding to the identified authentication protocol.
1. A method comprising:
receiving, by a computing device, a request from a client device to access a resource; determining, by the computing device, context information that corresponds to the request and comprises a plurality of elements; assigning, by the computing device, scores to individual elements of the plurality of elements; combining the scores to generate a second score; assigning, by the computing device, an authentication level to the request based on a user identity and the combined score;
generating, by the computing device, an authentication challenge based on the authentication level, the authentication challenge comprises an initial token, the initial token comprising the user identity, identification of the resource for which access is being requested, at least a portion of the context information, authentication parameters, and an assertion that authentication credentials included in the request have been verified;
receiving, by the computing device, an updated token from the client device in response to transmission of the authentication challenge to the client device, the updated token generated by inclusion in the initial token an indication of authentication of a user of the client device to one or more authentication services, the authentication being accomplished with use of the authentication parameters, and the indication being included in the initial token by the one or more authentication services as a part of a response to an authentication request from the client device made in response to the authentication challenge; and
providing, by the computing device, the client device with access to the resource based on the authentication of the user of the client device to one or more authentication services as indicated by the updated token.
2. The method of claim 1 , further comprising saving the initial token by the computing device.
3. The method of claim 1 , further comprising, by the computing device:
identifying an authentication service for executing at least one authentication scheme; and
including the identification of the authentication service in the authentication parameters.
4. The method of claim 3 , further comprising:
upon receipt of the authentication challenge, transmitting, by the client device, an authentication request comprising the initial token;
receiving, by client device, the updated token which comprises an assertion indicating a status of user authentication upon execution of the at least one authentication scheme.
5. The method according to claim 4 , further comprising: determining, by the client device, upon receipt of the updated token, whether all authentication schemes included in an identified authentication protocol have been executed; and upon determining that all authentication schemes included in the identified authentication protocol have been executed, transmitting the updated token to the computing device.
6. The method of claim 5 , further comprising, by the computing device, granting the request for accessing the resource upon determining that the one or more assertions included in the updated token satisfy the identified authentication protocol.
7. The method of claim 6 , further comprising, by the computing device, discarding the updated token upon granting the request for accessing the resource.
8. The method of claim 6 , further comprising, by the computing device, discarding the initial token upon granting the request for accessing the resource.
9. The method of claim 6 , further comprising, by the computing device:
determining whether a timestamp associated with the updated token is within a threshold time limit; and
granting the request for accessing the resource upon determining that the timestamp is within the threshold time limit.
10. The method of claim 5 , further comprising upon determining that all authentication schemes included in the identified authentication protocol have not been executed, transmitting the updated token to a given authentication service.
11. The method of claim 1 , wherein the initial token comprises an initial assertion indicating successful authentication of one or more authentication credentials included in the request.
12. The method of claim 1 , wherein the request comprises user information identifying the user.
13. The method of claim 1 , wherein the resource is a self-service password reset service.
14. The method according to claim 1 , wherein the initial token includes information specifying performance of an execution of at least one authentication protocol by the one or more authentication services.
15. The method according to claim 1 , wherein the indication comprises an assertion indicating a status of user authentication upon execution of at least one authentication scheme.
16. A computing system, comprising:
a processor; and a non-transitory computer-readable storage medium comprising programming instructions that are configured to cause the processor to implement a method for authenticating a user in the computing system, wherein the programming instructions comprise instructions to:
receive a request from a client device to access a resource; determine context information that corresponds to the request and comprises a plurality of elements; assign scores to individual elements of the plurality of elements;
combining the scores to generate a combined score;
assign an authentication level to the request based on a user identity and the combined score; generate an authentication challenge in accordance with the authentication level, the authentication challenge comprises an initial token, the initial token comprising the user identity, identification of the resource for which access is being requested, at least a portion of the context information, authentication parameters, and an assertion that authentication credentials included in the request have been verified;
receive an updated token from the client device in response to transmission of the authentication challenge to the client device, the updated token generated by inclusion in the initial token an indication of authentication of a user of the client device to one or more authentication services, the authentication being accomplished with use of at least one authentication protocol and the authentication parameters, and the indication being included in the initial token by the one or more authentication services as part of a response to an authentication request from the client device made in response to the authentication challenge; and
provide the client device with access to the resource based on the authentication of the user of the client device to the one or more authentication services as indicated by the updated token.
17. The computing system according to claim 16 , wherein the programming instructions further comprise instructions to cause the client device to: transmit an authentication request that comprises the initial token; and receive the updated token that comprises an assertion indicating a status of user authentication upon execution of at least one authentication scheme.
18. The computing system according to claim 16 , wherein the programming instructions further comprise instructions to cause the client device to: determine, upon receipt of the updated token, whether all authentication schemes included in an identified authentication protocol have been executed; and upon determining that all authentication schemes included in the identified authentication protocol have been executed, transmit the updated token to the processor.
19. The computing system according to claim 17 , wherein the programming instructions further comprise instructions to cause the processor to grant the request for accessing the resource upon determining that the one or more assertions included in the updated token satisfy an identified authentication protocol.